File Manager Advanced Shortcode <= 2.3.2 - Unauthenticated Remote Code Execution through shortcode

CVE-2023-2068

Summary

The File Manager Advanced Shortcode plugin for WordPress, specifically versions up to 2.3.2, is susceptible to a Remote Code Execution vulnerability. This flaw arises from an inadequate restriction on the uploaded file types permitted when utilizing the shortcode, which allows unauthorized users to upload files with disallowed MIME types, including PHP scripts. Consequently, this vulnerability poses a serious risk as it permits potential exploitation without the need for user authentication.

References